On 7/26/06, Jeffrey Williams <[EMAIL PROTECTED]> wrote:
I am not running anything that is trying to use the loopback interface on this box.
Blocking traffic on the loopback will cause many odd problems. Always use set skip on lo
The following rule passes traffic in on the internal interface, "pass in on $iif inet from $inwr to any keep state", and there is no rule blocking traffic out on the internal interface.
The problem here is that the NAT translation of the packet takes place before pass and block rules are processed. NAT'ed packets appear to be incoming on the internal interface with an IP address of the external interface. So you can pass all traffic on the internal interface, or get a little fancier and use tags with NAT: nat on $ext_if from $int_if:network to !$int_if:network tag NAT -> ($ext_if:0) pass all tagged NAT keep state Or for the minimal ruleset: nat pass on $ext_if from $int_if:network to !$int_if:network -> ($ext_if:0) -- Jon _______________________________________________ freebsd-pf@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-pf To unsubscribe, send any mail to "[EMAIL PROTECTED]"
